A deep dive into the SBOM format SPDX with Kate Stewart and Gary O'Neall

Nerding Out With Viktor

In this episode of "Nerding Out with Viktor," Kate Stewart from the Linux Foundation and Gary O'Neall, a long-time SPDX contributor, join Viktor to explore the evolution and impact of SPDX (Systems Package Data Exchange) in software transparency. The conversation traces SPDX's journey from its origins in license compliance to its current pivotal role in security and vulnerability tracking, revealing how this open standard is shaping modern software development practices.

Kate and Gary provide deep technical insights into the challenges teams face when generating accurate Software Bills of Materials (SBOMs), including complex scenarios involving circular dependencies and component uncertainty. Through practical examples from their work with various organizations, they demonstrate how these real-world challenges have influenced the development of SPDX tools and specifications.

The discussion delves into current initiatives for integrating SBOM generation into build systems, with specific focus on implementations in the Zephyr and Yocto projects. They also explore ongoing efforts to implement build-time SBOM generation for the Linux kernel, highlighting both the technical approach and practical benefits for development teams.

Viktor, Kate, and Gary examine the growing regulatory requirements surrounding SBOMs, particularly in safety-critical systems, and how SPDX 3.0 is being designed to meet these demands while supporting modern CI/CD pipelines. The conversation illuminates the technical considerations behind maintaining compatibility with existing tools while expanding functionality for new use cases. As an open, community-driven project, SPDX continues to evolve with industry needs, offering solutions for compliance, security vulnerabilities, and supply chain transparency in modern software development workflows.

]]>